Senior Web Application Penetration Testing Engineer

Crowe México; Naucalpan de Juárez; Remote; MXN 800,000 - 1,100,000; Full time

Benefits offered by this job

Remote position

Job summary

Crowe México is seeking a Senior Web Application Penetration Testing Engineer with expertise in web apps, APIs, and AI-assisted security automation. The role emphasizes manual testing, strong problem solving, and clear communication of risk to stakeholders.

Remote position available, with a focus on Mexico-based clients. 5+ years of hands-on experience and Python scripting are highly valued, along with a strong grasp of OWASP guidelines and security best practices.

Qualifications

• 5+ years of hands-on experience in application security or penetration testing.
• Strong understanding of HTTP, REST APIs and common web vulnerabilities.
• Experience beyond automated scanners with manual testing.
• Familiarity with OWASP WSTG and security risks.
• Hands-on Python scripting for testing or automation.
• Ability to validate findings and communicate clearly.

Responsibilities

• Perform in-depth manual penetration testing of web apps and REST APIs.
• Identify and validate complex vulnerabilities including auth flaws and logic errors.
• Analyze architecture, auth models, and data flows for weaknesses.
• Use Burp Suite and other tools to reproduce findings with PoCs.
• Leverage AI-assisted tools to support reconnaissance and test case generation.
• Develop Python scripts and integrations to automate tasks and workflows.
• Document findings with business impact and remediation guidance.

Skills

Web app security

API testing

Python scripting

Security automation

Analytical thinking

Tools

Burp Suite

Job description

About Us

Our professional firm boasts over 70 years of experience and is ranked 5th nationally and 9th globally as part of Crowe Global, a network of over 769 offices in 129 countries worldwide. Our prestige, with 19 offices in Mexico, is built on experience, reputation, and the quality of our Audit, Tax, and Consulting solutions, among others. We provide the best advice so our clients can make smart decisions!

About Us

Our professional firm boasts over 70 years of experience and is ranked 5th nationally and 9th globally as part of Crowe Global, a network of over 769 offices in 129 countries worldwide. Our prestige, with 19 offices in Mexico, is built on experience, reputation, and the quality of our Audit, Tax, and Consulting solutions, among others. We provide the best advice so our clients can make smart decisions!

Senior Web Application Penetration Testing Engineer & Offensive AI

What are we looking for?

We are seeking a senior security professional with strong hands- on expertise in web application and API penetration testing, combined with AI-assisted security automation. The ideal candidate can identify and validate complex vulnerabilities trough deep manual testing and leverage Python and AI-driven tools to improve testing efficiency, coverage, and accuracy.

Key Responsabilities

• Perform in – depth manual penetration testing testing of web applications, REST APIs, and supporting services.
• Identify and validate complex vulnerabilities, including broken access control, authentication weaknesses, business logic flaws, injection, and privilege escalation.
• Analyze application architecture, authentication mechanisms, authorization models, and data flows to identify exploitable security weaknesses.
• Use Burp Suite and other security testing tools to manipulate requests, validate findings, and develop reproducible proofs of concept.
• Leverage approved AI and LLM-based tools to support reconnaissance, vulnerability analysis, test case generation, and attack path identification.
• Develop and improve Python scripts, prompts, agents, and API integrations to automate repetitive testing tasks and enhace security assessment workflows.
• Document findings clearly, communicate technical and business impact, and recommend remediation strategies.

Requiered Qualifications

• 5+ years of hands- on experience in application security or penetration testing, including substantial web application ad API testing.
• Strong understanding of HTTP, REST APIs, authentication, authotization, session management, and common web security vulnerabilities.
• Practical experience performing manual penetration testing beyond automated scanners and standard vulnerability checks.
• Strong knowledge of the OWASP Web Security Testing Guide and common application security risks.
• Hands‑on experience using Burp Suite or equivalent web application security testing tools.
• Experience writing or modifying Python scripts for security testing or automation.
• Abillity to validate vulnerabilities, develop proofs of concept, and communicate technical findings effectively.

Preferred Qualifications

• Experience using AI-assisted security testing tools, LLM-based security workflows, or offensive security agents.
• Experience developing reusable prompts, automation scripts, or API integrations for penetration testing.

What do we expect from you?

We are looking for a detailed- oriented, analytical professional with strong problem-solving skills and hands- on approach security testing.

Strong leadership, communication, and team development skills.

What do we offer?

• Attractive and competitive salary, determined based on the candidate's experience and executive skills and benefits
• Remote position
• Job stability and an excellent corporate work environment.
• Growth opportunity and career plan continue within a top-tier global firm.

Together we will achieve great results!